net-kingdom/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md

---
id: NK-WP-0009
type: workplan
title: NetKingdom Security Pattern Tutorials
domain: infotech
repo: net-kingdom
status: finished
flavor: implementation
owner: codex
topic_slug: netkingdom
planning_priority: medium
planning_order: 9
created: 2026-05-17
updated: "2026-10-03"
depends_on:
  - NK-WP-0008
state_hub_workstream_id: "d4d02dbf-3974-502d-8b87-b776fc63e17e"
---

# NK-WP-0009 - NetKingdom Security Pattern Tutorials

## Goal

Build practical tutorials that show operators and developers how to
implement canonical NetKingdom security architecture patterns in
NetKingdom-enabled IT infrastructures.

Where NK-WP-0008 is the pattern library, this workplan is the hands-on
path: runnable examples, checklists, commands, manifests, verification
steps, and failure-mode exercises.

## Context

The platform needs more than architecture statements. A new deployment
should be able to answer:

- How do I issue identity tokens in lightweight mode versus expanded
  mode?
- How do I ask flex-auth for a resource decision?
- How do I vend temporary object-storage credentials?
- How do I deploy OpenBao and avoid secret zero traps?
- How do I use short-lived SSH certificates for agents and automations?
- How do I verify audit records and break-glass behavior?

Tutorials turn canonical patterns into repeatable implementation
practice without forcing every application repo to rediscover the same
steps.

## Scope

In scope:

- tutorial structure and style guide
- runnable or copy-pasteable examples
- local/dev and production variants where appropriate
- verification and rollback steps
- integration references to key-cape, flex-auth, ops-warden,
  ops-bridge, railiance-platform, and artifact-store

Out of scope:

- deploying live services directly from this repo
- replacing repo-specific operator runbooks
- hiding provider-specific security differences behind one generic
  command

## Create the tutorial template

```task
id: NK-WP-0009-T01
status: done
priority: high
state_hub_task_id: "3c6824a0-39e6-51f5-b46f-5861a9375439"
```

Create a tutorial template with prerequisites, architecture context,
commands, manifests, verification, rollback, threat checks, and
cross-repo ownership notes.

## Demonstrate temporary object credentials

```task
id: NK-WP-0009-T02
status: done
priority: high
state_hub_task_id: "d13760fd-2527-5a39-acb1-11c8091d65a1"
```

Write the first tutorial: "Vend temporary S3 credentials from a
NetKingdom identity token", covering key-cape/Keycloak identity,
flex-auth authorization, object-store STS exchange, and SDK consumer
configuration.

**Drafted 2026-09-29 as a native pack**: `runbooks/object-storage-sts/` (`nk.object-storage-sts`, validates,
`unexercised`) with an offline validator, `check_sts.py`, encoding the request, response, deny and `credential_process`
contract from `docs/object-storage-sts-credential-vending.md`. The offline checks were run and pass, including the
refusals (TTL over one hour, wildcard action). No credential-vending service is deployed (the baseline is NK-WP-0007),
so the live stage records "not deployed" honestly. The task closes on a run receipt from the UI, like T03-T05.

## Document the existing OpenBao operating path

```task
id: NK-WP-0009-T03
status: done
priority: high
state_hub_task_id: "16cf51a4-0763-59e9-9b4c-d486f5bde908"
```

Write "Deploy OpenBao as the canonical secrets manager for a
NetKingdom-enabled Railiance platform", linking to the Railiance
Platform workplan and covering auth methods, secret engines, CSI/ESO
integration, leases, unseal, backup, and break-glass.

## Document SSH certificates and tunnels

```task
id: NK-WP-0009-T04
status: done
priority: medium
state_hub_task_id: "1d28e3f1-fb39-5d0e-a7ee-ce2e9bc16ed5"
```

Write "Use short-lived SSH credentials for admins, agents, and
automations", using ops-warden and ops-bridge as the reference
implementation.

## Integrate a protected flex-auth consumer

```task
id: NK-WP-0009-T05
status: done
priority: medium
state_hub_task_id: "c380ef19-4bc2-5ade-b127-baf18c64bf35"
```

Write "Add a protected system to flex-auth", covering resource
manifests, action vocabulary, claim envelopes, policy packages,
decision envelopes, and delegated PDP options.

## Verify the tutorial outcomes

```task
id: NK-WP-0009-T06
status: done
priority: medium
state_hub_task_id: "5b6a1670-a283-56e9-892e-ef8b91194a7b"
```

Add tutorial verification fixtures or checklists so each tutorial has a
clear "done when" outcome and does not become prose-only guidance.

## Acceptance Criteria

- Tutorials are grouped under a stable docs path with a repeatable
  format.
- Each tutorial maps back to one or more NK-WP-0008 patterns.
- Tutorials name the owning repo for every concrete implementation
  step.
- Tutorials include verification and rollback guidance, not just happy
  path commands.

## Infrastructure review — 2026-09-28

Keep this plan in backlog, with the first implementation slice T01 + T03 +
T04 + T06: document the paths already operated and capture safe verification
and recovery outcomes. OpenBao is already deployed and private; T03 should
teach consumption, attended access and recovery, with greenfield deployment
kept as an isolated lab exercise. Use the named `openbao-ui-railiance01`
tunnel and owner runbooks, not a public Bao URL or copied runtime manifest.

T02 is conditional on an owner-backed object-store STS issuer and refusal/lease
proof; ADR-0008 is architecture, not evidence that the endpoint is live. T05
must include projected caller identity, audience, binding and unauthorized
caller rejection: all six live consumers now enforce caller authentication.
Use accepted IAM v0.3 and owner package declarations under ADR-0015. T06
requires executable safe fixtures or repeatable outcome checks; never teach
operators to apply the stale tenant-engine reference YAML.

Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).

## Rehearsal receipts — 2026-10-02

Bernd ran three packs cleanly in project `nk-rehearsal` (rehearsal environment, no deviations); the engine derives `rehearsed`:
`nk.object-storage-sts` (run 20261002-223449-dfa0b3, T02), `nk.ssh-certificates` (20261002-225810-0d8ab7, T04; first `sign` attempt failed
and was retried with the missing `WARDEN_CONFIG`), `nk.openbao-operating-path` (20261002-234245-d73656, T03). T02, T03 and T04 are done.
Limits: the S3 pack proves the contract offline, not a live service; the SSH tunnel stage is recorded not proven and the rehearsal config
bypasses the flex-auth policy gate; the OpenBao pack is read-only. T05 (`nk.protected-system-flex-auth`) has no run yet.

`nk.protected-system-flex-auth` (run 20261002-235239-c46227) completed cleanly in `nk-rehearsal`, so T05 is done and all four tutorials are
rehearsed packs. The markdown verifier is retired (NK-WP-0044-T06).